6 ms·

> If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do th

> If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do that. I want secure messaging, not encrypted SMS. I want my messages to sync properly between arbitrary number of devices. I want my messaging history to not be lost when I lose a device. I want not losing my messaging history to not be a paid feature. I want to not depend on a shady crypto company to send a message.

some_furry 9mo ago
> I want secure messaging, not encrypted SMS. I send long messages via Signal, typed on a desktop computer, all the time. (In fact, I almost exclusively use Signal through my desktop app.) You don't have to use it like "encrypted SMS"! You're free. > I want my messages to sync properly between arbitrary number of devices. I want my messaging history to not be lost when I lose a device. OK. https://signal.org/blog/a-synchronized-start-for-linked-devices/ https://signal.org/blog/a-synchronized-start-for-linked-devi... > I want not losing my messaging history to not be a paid feature. I genuinely don't understand what you mean here. From https://signal.org/blog/introducing-secure-backups/ https://signal.org/blog/introducing-secure-backups/ "If you do decide to opt in to secure backups, you’ll be able to securely back up all of your text messages and the last 45 days’ worth of media for free." If you have a metric fuckton of messages, that does cost money, sure, but as they say: "If you want to back up your media history beyond 45 days, as well as your message history, we also offer a paid subscription plan for US$1.99 per month." "This is the first time we’ve offered a paid feature. The reason we’re doing this is simple: media requires a lot of storage, and storing and transferring large amounts of data is expensive. As a nonprofit that refuses to collect or sell your data, Signal needs to cover those costs differently than other tech organizations that offer similar products but support themselves by selling ads and monetizing data." If you want Signal to host the encrypted storage, that costs money. If you don't want to pay Signal money, they provide 45 days of backup for free. If you want to self-host your own backups (at your own cost), that's easy to do. https://imgur.com/a/EIfaIee https://imgur.com/a/EIfaIee You can literally set up SyncThing to stream your on-device backups to your NAS, cloud storage, or whatever. > I want to not depend on a shady crypto company to send a message. Shady crypto company? Are you referring to MobileCoin? That feature isn't in the pipeline for sending messages. I checked! https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...
- goldsteinq 9mo ago
  > You don't have to use it like "encrypted SMS"! You're free. Using it as something more than encrypted SMS requires persistent message history between devices. > metric fuckton of messages “More than 45 days” is a metric fuckton? Seriously? > If you want Signal to host the encrypted storage, that costs money. If you don't want to pay Signal money, they provide 45 days of backup for free. I don’t want Signal to store my messages. I want Signal to not lock in my messages on their servers, so I can sync them between my devices and back them up into my own backups. > If you want to self-host your own backups (at your own cost), that's easy to do. Except there’s no way to move it between platforms. I have more than one device. > Are you referring to MobileCoin? That feature isn't in the pipeline for sending messages. I don’t want shady crypto company to hold my data hostage, and there’s no way to store it on my hardware and then move it between platforms. That’s my problem with signal. > A Synchronized Start for Linked Devices It only properly transfers 45 days. You can’t have more than one phone. Phones are special “primary devices” and AFAIK you can’t restore your messages if you lose your phone even if you have logged-in Signal Desktop.
  - some_furry 9mo ago
    I literally included a screenshot that shows you can setup backups in a directory on your device and then use your own backup solution. Signal is not holding you hostage.
    - goldsteinq 9mo ago
      Yes, if your only device is a single Android phone you can do that. You can’t, however, use that backup to populate your message history on other platforms. I’ve already lost message history consistency because one of my devices was offline for too long. The messages are there on my other device, but Signal refuses to let me copy my data from one of my devices to another. Signal is, quite literally, worse at syncing message history than IRC — at least with IRC I can set up a bouncer and have a consistent view of history on all of my devices, but there’re no Signal bouncers.
tptacek 9mo ago
I seriously don't care what messenger you use, as long as it isn't email, which can't be made secure. Pick something open source. It'll be less secure than Signal, but way more secure than email.
Natanael_L 9mo ago
Then your next best bet is Matrix.org. Not to the same security standard as Signal, but if you don't have a specific threat against you then it's fine.
- goldsteinq 9mo ago
  Pros of Matrix: it actually has a consistent history (in theory); no vendor lock-in. Cons of Matrix: encryption breaks constantly. Right now I’m stuck in a fun loop of endlessly changing recovery keys: https://github.com/element-hq/element-web/issues/31392 https://github.com/element-hq/element-web/issues/31392
  - Arathorn 9mo ago
    bleurgh. that issue is very actively under investigation (modulo xmas). please can you submit debug logs from Element Web referencing that issue.
    - goldsteinq 9mo ago
      I’m facing it on Element Desktop, but I’ll try to reproduce it on Element Web. I’ve tried to submit logs from Element Desktop, but it says that `/rageshake` (which I was told to do) is not a command. I’m happy to help with debugging this, but I’m not sure how to submit logs from Desktop. Something like this happens basically every time I try to use Matrix though. Messages are not decrypting, or not being delivered, or devices can’t be authenticated for some cryptic reason. The reason I even tried to use Element Desktop is because my nheko is seemingly now incapable of sending direct messages (the recepient just gets infinite “waiting for message”).
      - Arathorn 9mo ago
        Weird. Encryption these days (in Element Web/Desktop and Element X at least) should be pretty robust - although this whole identity reset thing is a known bug on Element Web/Desktop. You can submit debug logs from Settings: Help & About: Submit Debug Logs, and hopefully that might give a hint on what's going wrong.

some_furry 9mo ago

> I want secure messaging, not encrypted SMS. I send long messages via Signal, typed on a desktop computer, all the time. (In fact, I almost exclusively use Signal through my desktop app.) You don't have to use it like "encrypted SMS"! You're free. > I want my messages to sync properly between arbitrary number of devices. I want my messaging history to not be lost when I lose a device. OK. https://signal.org/blog/a-synchronized-start-for-linked-devices/ https://signal.org/blog/a-synchronized-start-for-linked-devi... > I want not losing my messaging history to not be a paid feature. I genuinely don't understand what you mean here. From https://signal.org/blog/introducing-secure-backups/ https://signal.org/blog/introducing-secure-backups/ "If you do decide to opt in to secure backups, you’ll be able to securely back up all of your text messages and the last 45 days’ worth of media for free." If you have a metric fuckton of messages, that does cost money, sure, but as they say: "If you want to back up your media history beyond 45 days, as well as your message history, we also offer a paid subscription plan for US$1.99 per month." "This is the first time we’ve offered a paid feature. The reason we’re doing this is simple: media requires a lot of storage, and storing and transferring large amounts of data is expensive. As a nonprofit that refuses to collect or sell your data, Signal needs to cover those costs differently than other tech organizations that offer similar products but support themselves by selling ads and monetizing data." If you want Signal to host the encrypted storage, that costs money. If you don't want to pay Signal money, they provide 45 days of backup for free. If you want to self-host your own backups (at your own cost), that's easy to do. https://imgur.com/a/EIfaIee https://imgur.com/a/EIfaIee You can literally set up SyncThing to stream your on-device backups to your NAS, cloud storage, or whatever. > I want to not depend on a shady crypto company to send a message. Shady crypto company? Are you referring to MobileCoin? That feature isn't in the pipeline for sending messages. I checked! https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ https://soatok.blog/2025/02/18/reviewing-the-cryptography-us...

goldsteinq 9mo ago
> You don't have to use it like "encrypted SMS"! You're free. Using it as something more than encrypted SMS requires persistent message history between devices. > metric fuckton of messages “More than 45 days” is a metric fuckton? Seriously? > If you want Signal to host the encrypted storage, that costs money. If you don't want to pay Signal money, they provide 45 days of backup for free. I don’t want Signal to store my messages. I want Signal to not lock in my messages on their servers, so I can sync them between my devices and back them up into my own backups. > If you want to self-host your own backups (at your own cost), that's easy to do. Except there’s no way to move it between platforms. I have more than one device. > Are you referring to MobileCoin? That feature isn't in the pipeline for sending messages. I don’t want shady crypto company to hold my data hostage, and there’s no way to store it on my hardware and then move it between platforms. That’s my problem with signal. > A Synchronized Start for Linked Devices It only properly transfers 45 days. You can’t have more than one phone. Phones are special “primary devices” and AFAIK you can’t restore your messages if you lose your phone even if you have logged-in Signal Desktop.
- some_furry 9mo ago
  I literally included a screenshot that shows you can setup backups in a directory on your device and then use your own backup solution. Signal is not holding you hostage.
  - goldsteinq 9mo ago
    Yes, if your only device is a single Android phone you can do that. You can’t, however, use that backup to populate your message history on other platforms. I’ve already lost message history consistency because one of my devices was offline for too long. The messages are there on my other device, but Signal refuses to let me copy my data from one of my devices to another. Signal is, quite literally, worse at syncing message history than IRC — at least with IRC I can set up a bouncer and have a consistent view of history on all of my devices, but there’re no Signal bouncers.

tptacek 9mo ago

I seriously don't care what messenger you use, as long as it isn't email, which can't be made secure. Pick something open source. It'll be less secure than Signal, but way more secure than email.

Natanael_L 9mo ago

Then your next best bet is Matrix.org. Not to the same security standard as Signal, but if you don't have a specific threat against you then it's fine.

goldsteinq 9mo ago
Pros of Matrix: it actually has a consistent history (in theory); no vendor lock-in. Cons of Matrix: encryption breaks constantly. Right now I’m stuck in a fun loop of endlessly changing recovery keys: https://github.com/element-hq/element-web/issues/31392 https://github.com/element-hq/element-web/issues/31392
- Arathorn 9mo ago
  bleurgh. that issue is very actively under investigation (modulo xmas). please can you submit debug logs from Element Web referencing that issue.
  - goldsteinq 9mo ago
    I’m facing it on Element Desktop, but I’ll try to reproduce it on Element Web. I’ve tried to submit logs from Element Desktop, but it says that `/rageshake` (which I was told to do) is not a command. I’m happy to help with debugging this, but I’m not sure how to submit logs from Desktop. Something like this happens basically every time I try to use Matrix though. Messages are not decrypting, or not being delivered, or devices can’t be authenticated for some cryptic reason. The reason I even tried to use Element Desktop is because my nheko is seemingly now incapable of sending direct messages (the recepient just gets infinite “waiting for message”).
    - Arathorn 9mo ago
      Weird. Encryption these days (in Element Web/Desktop and Element X at least) should be pretty robust - although this whole identity reset thing is a known bug on Element Web/Desktop. You can submit debug logs from Settings: Help & About: Submit Debug Logs, and hopefully that might give a hint on what's going wrong.